Please report vulnerabilities privately through GitHub: open this repository's Security tab and choose Report a vulnerability. Do not open a public issue for a vulnerability. If private reporting is unavailable, open an issue that only asks for a private contact, without details.

Include a minimal reproduction using synthetic data (see examples/generate_samples.py). Do not include private, production, or personal data in a report.

SheetProof treats every tool argument and every attached-file id as untrusted, because a model can be steered by prompt injection and Open WebUI copies the attachment list from the client request. Expressions are checked against an AST allow-list and never evaluated by Python or pandas, file ids must pass Open WebUI's read rule for files, and parsing is bounded by size limits. docs/security.md describes each property, its limits and the residual risks.